CVE-2004-0256 GNU libtool before 1.5.2, during compile time, allows local users to overwrite arbitrary files via a symlink attack on libtool directories in /tmp.
LowCVSS 2.1
EPSS 0.35%
- Published
- Updated
- Exploit status
- No public exploit known
Description
GNU libtool before 1.5.2, during compile time, allows local users to overwrite arbitrary files via a symlink attack on libtool directories in /tmp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU libtool | = 1.0 | No fix listed |
| GNU libtool | = 1.1 | No fix listed |
| GNU libtool | = 1.2 | No fix listed |
| GNU libtool | = 1.3 | No fix listed |
| GNU libtool | = 1.3.2 | No fix listed |
| GNU libtool | = 1.3.3 | No fix listed |
| GNU libtool | = 1.3.4 | No fix listed |
| GNU libtool | = 1.3.5 | No fix listed |
| GNU libtool | = 1.4 | No fix listed |
| GNU libtool | = 1.4.1 | No fix listed |
| GNU libtool | = 1.4.2 | No fix listed |
| GNU libtool | = 1.4.3 | No fix listed |
| GNU libtool | = 1.5 | No fix listed |
| debian/libtool(Debian:12) | < 1.5.6 | 1.5.6 |
| debian/libtool(Debian:13) | < 1.5.6 | 1.5.6 |
| debian/libtool(Debian:14) | < 1.5.6 | 1.5.6 |
References
- CLA-2004:811 vendor-advisory
- 10777 third-party-advisory
- www.geocrawler.com
- 3795 vdb-entry
- 20040130 Symlink Vulnerability in GNU libtool <1.5.2 mailing-list
- 9530 patch vdb-entry vendor-advisory
- libtool-insecure-temp-directory(15017) vdb-entry
- Debian Security Tracker CVE-2004-0256 vendor-advisory